For those using Boclean

False Positive affecting many users.
File AEC.SYS is a valid windows system file, detected as a trojan by Boclean. Don't delete it.
Discussion Here: http://forums.comodo.com/index.php?topic=9036.msg63269;boardseen#new

 

Almost unbelievable that a security software reports a valid Windows system file as a false positive. I can understand any other system file from another software, but WINDOWS ? Don't they test anything anymore nowadays,
before giving it to users ? Sigh

 

Some trojans and other malware modify windows files. If you allow them to be deleted you will need to replace them with original windows versions or you'll probably end up in an endless reboot cycle.

Examples:

sfc.dll modified by bankfraud trojan
ndis.sys modified by spambot

 

Thanks for the info. I didn't know this, but in this case it wouldn't matter.
My boot-to-restore will fix this automatically.

 

Ive seen on other forums than some have this alert. I wonder what happens really. Most of us who use Boclean do not get this false positive, and all of us do have this file in question....
I mean if it is a false positive shouldnt all the users with boclean installed and running get the FP?

Could it be that with all the security software that we have nowadays could have something to do with it?
I mean security software dig deep into window and acts as a layer interpreting the data flow and something goes wrong there when it is the next security software turn to interpret the data flow? provided it is actually a false positive and not a valid alert.
I admit I do not know how security software work really, it was just a mental picture that poped up in my head.

 

Hi Guys,

Windows will replace the file, should you allow Bo to delete & clean the registry. Next reboot its back. Been there done that.

The correct size of aec.sys is 140 kb, so a larger size would be a tip off. Thanks to LondonBeat for the size.

Also the recent M$ patch tuesday, may have modified/replaced contributing to the problem, causing Bo to go a little nuts. Perhaps the folks, who did not patch tuesday don't have th FP.

also on this subject see: https://www.wilderssecurity.com/showthread.php?t=175259.

There seeing alot of posts on FP's at Comodo.

Take Care
Rico

 

Thanks Rico, I forgot all about the infamous windows updates. I noticed that I have 1 critical and 3 windows patches waiting for download at windows update. I do not know why I have not been alerted to these, but I will download them to see if I can join you all reporting a false positive

 

Originally posted by Rico

Which is the size of the AEC.SYS file detected, here.

 

On my computer I have two aec.sys :
C:\WINDOWS\Driver Cache\i386\aec.sys = 140KB
C:\WINDOWS\system32\drivers\aec.sys = 140KB

 

Hi Guys,

Bo has 4 updates waiting today, which seems to have fixed the FP.

Erik - I also have aec.sys, all over the hd, thats how windows can replace it, after Bo's supposedly deleted it.

Take Care
Rico

 

Also the recent M$ patch tuesday, may have modified/replaced contributing to the problem, causing Bo to go a little nuts. Perhaps the folks, who did not patch tuesday don't have th FP.

Haven't patched yet at M$ update,though i get the BC alert !!